robertpofuk commented on code in PR #72262:
URL: https://github.com/apache/airflow/pull/72262#discussion_r3980125261
##########
providers/edge3/src/airflow/providers/edge3/worker_api/auth.py:
##########
@@ -59,17 +108,31 @@ def _forbidden_response(message: str):
)
+def _check_method_claim(method: str, payload: dict) -> None:
+ """
+ Verify the signed ``method`` claim for shared-secret tokens.
+
+ Tokens minted by the Edge API carry the request ``method`` they are valid
+ for. Tokens issued by an external OIDC provider do not, so the check is
+ skipped when OIDC verification is enabled.
+ """
+ if _trusted_jwks_url():
Review Comment:
Addressed this bit differently. My IDP does not provide iss or other
idenfiable info so in my vendored impl i did custom fuction so I didn't make
`jwt_issuer` strictly required — it can
be empty *if* you set a `jwt_verifier`. Some IdPs are per-deployment and
binding on
`sub`/`scope` in the verifier is more useful than on `iss`. I can add other
fixed checks but would keep jwt_verifier. When iss jwt_issuer is not defined
jwt_verifier is required so some kind of authorzataion must ber provided
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
